Computer networks, and in particular the web servers, routers, switches, firewalls and end hosts which make up the Internet as well as private intranets have become critical to the operation of many organizations. Recently there have been a number of highly publicized attacks on network equipment belonging to commercial enterprises, government institutions and major internet service providers. This can clearly affect the ability of these institutions to access information, or even to conduct business as usual. Given the widespread adoption of the Internet, in the not to distant future it is foreseeable that such an attack might actually disrupt the conduct of society in general.
It has been estimated that even a three hour outage of the popular Yahoo servers could cause a loss of commerce and advertising revenue of about $500,000.
Tests have determined that over twelve thousand attacks on five thousand distinct Internet hosts belonging to more than two thousand distinct organizations occurred during a three week period early in 2002.
And, during one week in October 2002, a powerful coordinated electronic attack was directed to the central thirteen servers that manage global Internet traffic. While the attack only lasted for one hour, it caused seven of the thirteen servers to fail to respond.
These attacks, often taking the form of so-called Denial of Service (DoS) attacks, impede the efficient functioning and provisioning of services by network infrastructure elements according to their intended purpose. The impact of such attacks is more pronounced than network congestion itself, due to the concentrated and targeted ability of such attacks to not only deplete specific resources but also clog traffic. In the extreme case, when such attacks are coordinated and distributed over many internetworking devices, they may result in multiple compromised Internet hosts that can disrupt the operation of the Internet itself.
Susceptibility to DoS attacks is an intrinsic problem for any service provisioning system where the occurrence of a potentially valid event (such as the request to make a connection, e.g., a Transmission Central Protocol (TCP SYN packet)) must first be processed to ascertain its validity. This is true even though the processing resources needed to handle a single event may be negligible. While such attacks can take on many forms, they typically generate traffic streams at very high data rates. The devices attempt to service even the simplest of commands being thrown at it an extraordinary rate can therefore cause the device to fail.
More particularly an internetworking device such as a router typically separates its functionality into control plane functions and data plane functions. The data plane is principally responsible for accepting transit packets at input ports and routing or switching them to output ports. On the other hand, the control plane is responsible for higher layer functions of the device, such as establishing routing tables and entering quality service policies. DoS attacks are thus commonly directed at control plane service functions that reside on route processors such as routers, switches, firewalls and the like, since they are the most likely to cause widespread disruption when they fail. These control plane service functions may include the execution of certain protocols such as a Border Gateway Protocol (BGP), Simple Network Management Protocol (SNMP), route table management, memory management and the like. Because the execution of such processes is critical to the operation of the route processor, when such attacks are directed at such functions, they can be devastating.
DoS attacks that target infrastructure devices they may cause a number of problems, including:
$ loss of line protocol keep alive functions, which causes a network connection to drop, leading to route flaps and major network transitions;
$ loss of routing protocol updates which can also lead route flaps and network transitions;
$ causing the control plane to utilize more central processing resources than planned;
$ causing route processors to lock up, or preventing them from completing higher priority tasks;
$ reduced response time at user command line prompts, preventing a human administrator from taking corrective action to respond to an attack;
$ consumption of route processor resources such as memory, buffers, data structures, causing negative side effects in being able to process other traffic;
$ back-up of packet queues leading to indiscriminant drops;
$ ultimately, crashing of the device.
Attempts to solve such problems in the past have included such approaches as Reverse Pass Forwarding (RPF) verification and Selective Packet Discard (SPD). Selectively based distributed packet filtering techniques apply filters to packets arriving from specific known mischievous Internet Protocol (IP) addresses. More sophisticated techniques can detect forged source IP addresses by determining the routes from which such disruptive packets originate.
A second technique is to apply an access list configured on an input interface to explicitly deny or limit specific problematic packet types. Hardware based rate limits can then be implemented as a throttling mechanism for the specific packet types so identified. For example, packets of the type SYN can be specifically rate limited on a particular port or other hardware, at least preventing the rate at which such packets are sent to the control plane. A hardware based rate limit may be applied to RPF failures, Internet Control Message Protocol (ICMP) unreachables, Time To Live (TTL) failures, Maximum Transmission Unit (MTU) failures, Internet Protocol Version 4 (IPv4) option bit packets, or similar packets.
While these methods all provide some level of control plane protection, specific features and implementations vary from platform to platform. There also remain packet types and scenarios in which a stated feature sets do not provide adequate control plane protection.
For example, based on current day capabilities, a system administrator could construct class maps and policy maps that are specific for control plane packets of known type. Once created, however, these policies would need to be included in the access policy for every interface in a network. Since there may typically be hundreds, if not thousands of ports in even a modest network, it is not typically feasible for network administrators to deploy and maintain such features everywhere.
Also, when control plane policies are defined within input port features, a significant performance impact typically results for transit (that is non-control plane) traffic. Because additional control plane classes and policies that need to be executed for transit packets as well as control plane destined packets, overall transit traffic performance is markedly reduced. An interface which previously had no configuration, would be forced to execute control plane policies for every packet it receives. This performance impact, rather than help, could thus actually hinder proper operation of currently deployed infrastructure.
For certain packet types that are destined for both the transit and control planes (i.e. special broadcasts, IPv4 option bits, etc.) it is also not possible to set different yet compatible service policies for packets within such a single class. There is for example nothing inherent in such a packet to help understand whether it is destined to the control plane or should be forwarded as a transit packet.
Thus, it is also not typically possible in all cases to configure specific classes to identify all control plane destined packet types, since these packet types cannot be readily identified, and current interface policies cannot be configured to control them efficiently.